Sensitive Information Exposure in WP Popular Posts Plugin for WordPress

CVE-2026-92548

What is CVE-2026-92548?

The WP Popular Posts plugin for WordPress is susceptible to sensitive information exposure due to improper handling of the 'context' parameter in its REST API implementation. This vulnerability allows unauthenticated attackers to retrieve sensitive data, including raw post titles, content, passwords, and other metadata, from non-public post objects. The exploitation occurs because the plugin's REST route accepts caller-defined parameters without proper permission checks, exposing sensitive details that should remain secured and inaccessible to unauthorized users.

References